rdmsm4x-changelog-20260828-1241-tyrell-phase2-fleet-hygiene

Implemented and committed source-only Tyrell.app single-instance and fail-closed promotion protections, plus a read-only fleet inventory; no runtime cleanup, installation, signing, deployment, launch, signal, or canary acceptance occurred.

Scope

• Source host: rdmsm4x
• Fleet read-only inventory: rdmsm4x, rdmbair13m5, rdmbair15m5, rdmpw3275m, jdmbair13m5; rdmpw3265m remained explicitly unreachable.
• Worktree: /Users/richh/dev/_worktrees/tyrell-phase2-fleet-hygiene
• Branch: codex/tyrell-phase2-fleet-hygiene
• Commit: 24b510142d24f15b32fe9d3904ecd3cd564ae543
• Handoff publication-status follow-up: b2ae6ac6b1e00552fc05e96fda57901e16022d01

Changed files

• App lifecycle: Sources/TyrellBarSupport/AppNavigationSignal.swift, Sources/tyrellbar/TyrellAppLauncher.swift, Sources/tyrell-app/TyrellAppMain.swift, Sources/tyrell-app/WindowSceneBridge.swift
• Promotion tooling: scripts/make_app_bundle.zsh, scripts/deploy_app_fleet.zsh, scripts/redeploy_app_fleet.zsh, scripts/install_app_local.zsh, scripts/accept_tyrell_app_canary.zsh, scripts/plan_app_deployment.zsh, scripts/lib/tyrell_app_lifecycle.zsh
• Tests: Tests/TyrellBarSupportTests/AppNavigationSignalTests.swift and four Tests/ScriptTests/*contract_test.zsh files
• Evidence: .handoff/phase2-fleet-app-inventory.md, .handoff/phase2-fleet-hygiene-report.md

Commands and verification

• Read-only SSH, find, ps, pgrep, lsof, launchctl print, plutil, codesign, lipo, and shasum inventory commands.
• zsh -n on every changed lifecycle script: pass.
• All Tests/ScriptTests/*.zsh: pass.
• swift test: pass, no failures.
• swift build --product tyrell-app: pass.
• swift build --product tyrellbar: pass.
• git diff --check: pass.
• gitleaks git --staged --redact: pass.
• Worktree clean after commit.
• Apple Notes publication was attempted and correctly refused because this session is Background, not Aqua; run the exact publisher command from rdmsm4x Terminal.app.

Preservation, stop-loss, and rollback

• No fleet/runtime state changed; there is no runtime rollback to perform.
• Source rollback: revert commit 24b510142d24f15b32fe9d3904ecd3cd564ae543 after integration review if required.
• The proposed installer preserves the prior verified app in a deterministic hash-addressed rollback directory and restores it on promotion verification failure.
• Unknown, development, renamed, or hash-mismatched processes are never signaled. No SIGKILL path exists.
• Existing user data, services, helpers, backup apps, and rollback apps were preserved.

Outstanding owner actions

• Integrate/review the source commit and exact cleanup manifest.
• Build/sign a real universal candidate only in the authorized Aqua session.
• Use rdmbair15m5 as the non-substitutable canary, validate Local Network responsible-code behavior with a real peer operation, and collect an artifact-bound acceptance receipt before any remaining-fleet promotion.
• Keep rdmpw3265m pending until it is reachable and freshly inventoried.
• Cleanup and redeployment remain separate, unperformed promotion states.